What is the CVSS score of CVE-2026-35154?

CVE-2026-35154 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35154?

Yes, a patch is available for CVE-2026-35154. Update the affected software to the latest version immediately.

Dell CVE-2026-35154

EUVD-2026-23917 MEDIUM

Improper Privilege Management (CWE-269)

2026-04-20 dell

GHSA-p3pj-xf59-54r5

Privilege Escalation Dell

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 28, 2026 - 20:54 nvd

Patch available

Apr 20, 2026 - 18:01 EUVD

Analysis Generated

Apr 20, 2026 - 17:54 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 17:15 euvd

EUVD-2026-23917

Analysis Generated

Apr 20, 2026 - 17:15 vuln.today

CVE Published

Apr 20, 2026 - 16:50 nvd

MEDIUM 6.3

DescriptionCVE.org

Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege management vulnerability in IDRAC. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation in IDRAC.

AnalysisAI

Dell PowerProtect Data Domain appliances versions 7.7.1.0-8.7.0.0, LTS2025 8.3.1.0-8.3.1.20, and LTS2024 7.13.1.0-7.13.1.60 contain an improper privilege management vulnerability in iDRAC that allows a high-privileged local attacker with user interaction to elevate privileges and perform unauthorized delete operations. The vulnerability requires high privileges and local access combined with user interaction, limiting real-world attack surface primarily to insider threats or physical facility access scenarios.

Technical ContextAI

Dell PowerProtect Data Domain appliances use iDRAC (Integrated Dell Remote Access Controller) for system management. This vulnerability stems from a CWE-269 (Improper Access Control) weakness in privilege management logic within iDRAC. The flaw allows a user possessing already-elevated privileges to leverage a configuration or interface flaw to gain additional unauthorized permissions for destructive operations (delete). The affected CPE string cpe:2.3:a:dell:powerprotect_data_domain_appliances indicates the vulnerability exists across multiple major versions of the Data Domain product line, with specific version ranges documented in the affected versions field.

RemediationAI

Apply the security update provided in Dell DSA-2026-060; consult the advisory for exact patched versions corresponding to each affected release (standard, LTS2025, and LTS2024). As a compensating control pending patch deployment, restrict iDRAC administrative access to a minimal set of named administrators, implement multi-factor authentication for iDRAC login if available, and enforce network-level access controls limiting iDRAC connectivity to trusted management networks only. Monitor iDRAC audit logs for privilege escalation attempts or unauthorized delete operations. Note that restricting iDRAC access may impact legitimate system administration workflows and should be tested in non-production environments first.